Privacy notice for a tradesperson with a website

A tradesperson with a website is a data controller: the contact form collects enquiries, the quotes and invoices hold names and addresses, the phone holds photographs of customers' homes, the accounting software and the review platform hold the rest, and the website sets cookies. The privacy notice has to be short, accurate for a one-person business, and cover the things a trade does with data that an office does not: the photographs of properties, the records kept for guarantees, and the review platforms that collect customers' details. For £595, fixed, with delivery in five working days, I draft the privacy notice and the cookie notice for the business and set out how the consent mechanism should work.

Who this is for

Plumbers, electricians, builders, decorators, roofers, gardeners, cleaners and other trades in England and Wales with a website, from a sole trader to a firm with a few staff.

What matters in a tradesperson's privacy notice

Why a sole trader with a website is a controller

The controller's duty under Article 13 of the UK GDPR is to tell customers what it does with their data, and a sole trader who holds customers' names, addresses, phone numbers and job details is a controller like any company, with the same duties and, in most cases, the same obligation to pay the fee and register with the Information Commissioner's Office under the Data Protection (Charges and Information) Regulations 2018 (the exemption for businesses that process only for core purposes without electronic systems rarely applies to a business with a website and a smartphone); the notice should be written for the size of the business, in a page or two, and should name the trader as the contact.

Enquiries, quotes and the data a job generates

The notice should state what the business collects (contact details from the enquiry form or a call, the property address and access arrangements, the details of the work, quotes, invoices and payments, correspondence and photographs) and the basis for each: the steps before and the performance of the contract under Article 6(1)(b), legal obligation for the records tax law requires, legitimate interests for the business's own administration and for keeping records in case of a dispute; it should say that enquiries that do not become jobs are kept for a short stated period and then deleted, and that the business does not sell or share customer details with other traders without asking.

Photographs of properties, before-and-after images and the customer's home

Photographs of a customer's property taken for the job (the existing installation, the work in progress, the finished work) are personal data where the property or the people in it are identifiable, and the notice should say that the business takes them for the job record and for guarantees and complaints, keeps them for the retention period, and uses them on the website or social media only with the customer's agreement and without the address or the customer's name unless they agree to that too; a before-and-after photograph that shows the street and the house number is a disclosure of where the customer lives, and the notice should commit the business to asking.

The accounting software, the review platforms and the other suppliers

The notice should name the categories of supplier that hold customer data for the business: the accounting and invoicing software (a processor, often hosted outside the United Kingdom under the safeguards Article 46 of the UK GDPR requires), the card payment provider, the review platform (which receives the customer's name and email to send the invitation and acts as a controller for the review it publishes), the trade body or scheme that registers the work (gas safety, electrical certification, building control notifications), the parts suppliers where a delivery goes to the customer's address, and the subcontractors who attend the job; the customer should know that a review invitation comes from the platform and what it does with their details.

Cookies, the contact form and the consent banner

Before a non-essential cookie or similar technology is placed, regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 requires consent, which covers the analytics and the embedded maps and videos on most trade websites, so the site needs a consent banner (no pre-ticked boxes, refusal no harder than acceptance, analytics off until accepted) and a cookie notice listing what is set, both of which the pack provides with guidance on the banner the website builder offers; the contact form should collect only what an enquiry needs, should link to the notice, and should not add the enquirer to a mailing list without the consent or the soft opt-in that regulation 22 of those Regulations requires.

Retention, guarantees and the records a trade keeps

The notice should state the retention: job records, invoices and photographs for the period tax law requires and for the length of any guarantee the business gives plus the limitation period for claims (which for building work can be years), certificates and notifications for the periods the schemes require, enquiries that go nowhere for a short period, and how an individual exercises the rights of access, correction, erasure, restriction, portability and objection, the one-month limit on the response, and the right to go to the Information Commissioner's Office; the business's registration with the Information Commissioner's Office, under the Data Protection (Charges and Information) Regulations 2018, belongs in the notice, and the operational note that comes with the documents lists the practical steps (a passcode on the phone, the photographs backed up, the paper records locked away) that make the notice true.

What it costs

Website privacy and cookies pack, £595. Privacy notice, cookie notice and consent guidance. Five working days.

DPA and privacy terms, £795. Data processing agreement plus privacy notice. Five working days.

Buying online forms the engagement on payment. The scope is what the data protection agreements and privacy terms page describes, you accept the Terms of Service at checkout, and I email you within four working hours to get started. If you would rather ask something first, email me.

What you get

• A data processing agreement that meets the statutory requirements and can be used as a schedule to your main contract
• A privacy notice written for people to read rather than to be scrolled past
• Clear allocation of controller and processor roles, which is where most confusion starts
• International transfer provisions where you use overseas suppliers
• Sub-processor and security provisions proportionate to what you do
• A note on the operational steps the documents assume you are taking

What is not included

• Full compliance audits and data mapping exercises
• ICO registration, which you do yourself
• Breach response and regulatory correspondence
• Cyber security certification such as Cyber Essentials
• Advice on data protection law outside the UK and EU

Questions I am often asked

I am a sole trader. Do I really need a privacy notice and to register?

In most cases both: a sole trader holding customers' details on a phone and a laptop is a controller, the website needs a notice, and the registration exemption rarely applies to a business with a website. The notice is a page or two written for the size of the business.

Can I put photos of jobs on my website?

With the customer's agreement and without the address or the name unless they agree to that. A photograph showing the house number tells the world where the customer lives.

Does my website need a cookie banner?

If it uses analytics, embedded maps or videos, or anything beyond the strictly necessary, yes. The pack includes the cookie notice and guidance on the banner the website builder offers.

Related guidance and services

• Data protection agreements and privacy terms, £595, the service this page describes
• Terms and conditions drafting, £995
• SaaS and technology contracts, £995
• Terms and conditions for a builder doing domestic work
• Cookie policy for a WordPress website

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.